@wavebirdai/api 0.1.0-beta.6 → 0.1.0-beta.8

package/README.md

@@ -70,7 +70,7 @@ You need a saved Wavebird Test project and placement in Dashboard, a Server Test
 5. Validate in Test: confirm the saved format and size, consent and GPC behavior, No-Fill, Stop/abort, and late responses. The generation result must continue independently of the ad path. Move to another package version or Live only through your normal project approval process.
 
 JavaScript and TypeScript use this same package. Complete Next.js JavaScript and TypeScript examples are included in `node_modules/@wavebirdai/api/examples/next-js` and `node_modules/@wavebirdai/api/examples/next-ts`. For other frameworks, use the explicit `@wavebirdai/api/server` and `@wavebirdai/api/browser` exports described below. The [REST reference](https://wavebird.ai/api/reference/endpoints) covers integrations without this package. The established [`wavebird`](https://www.npmjs.com/package/wavebird) SDK is a separate package.
-
+
 ## Server and browser boundary
 
 `@wavebirdai/api/server` exports `createPublisherServer`. Configure it with server-only Project ID, Server Test or production Key, preference signing secret, the publisher's real request authorization function, exact `publicOrigins`, and the saved project/placement values shown in the dashboard. The origin list is required. The package compares the browser Origin with a configured public origin whose host matches the route Host, even when Next.js or a proxy gives the route an internal URL. `localhost` and `127.0.0.1` are separate origins, and each port and scheme must match exactly; HTTP loopback is available only with a Server Test Key. A production key also requires its separately approved project and Wavebird server authority. Omit `bidfloor` and `bidfloorCurrency` to inherit saved pricing. An explicit override supplies both a nonnegative amount, including zero, and a three-letter currency; the API validates it against the saved project. It returns authenticated `placementPOST`, `consentGET`, `consentPOST`, and `withGeneration` handlers, plus the server-only `reportGeneration(jobId, event)` method. The helper constructs the existing `/v1/placements`, `/v1/consent`, and `/v1/jobs/{id}/generation/{event}` requests; it does not introduce a new Wavebird protocol. The Wavebird API remains authoritative for saved scope, creative formats, duration, fallback, and financial classification.

package/dist/browser.js

@@ -20,8 +20,14 @@ function loadRenderer(url) {
 
 export function createPublisherAds(options) {
   const target = options.target;
-  if (!target || !options.userId || !options.conversationId) throw new Error("Application container and session are required");
+  const requiredText = value => typeof value === "string" && value.trim().length > 0;
+  if (!target || !requiredText(options.userId) || !requiredText(options.conversationId))
+    throw new Error("Application container and session are required");
   if (!["chat", "code", "image", "voice", "agent"].includes(options.jobType)) throw new Error("publisher_job_invalid");
+  if (typeof options.clientId !== "string" || !options.clientId.startsWith("wbproj_"))
+    throw new Error("publisher_project_invalid");
+  if (typeof options.surfaceId !== "string" || !/^[A-Za-z0-9_-]{1,128}$/.test(options.surfaceId))
+    throw new Error("publisher_placement_invalid");
   const turnBinding = options.turnBinding === true;
   const validId = value => typeof value === "string" && /^[A-Za-z0-9_-]{1,128}$/.test(value);
   if (turnBinding && !validId(options.sessionId)) throw new Error("publisher_trusted_session_required");
@@ -64,7 +70,8 @@ export function createPublisherAds(options) {
   const prepare = () => { if (!disposed && sponsor) void sponsor.prepare().catch(() => {}); };
   function setConversation(next) {
     if (disposed) return;
-    if (!next.userId || !next.conversationId) throw new Error("Application session is required");
+    if (!requiredText(next?.userId) || !requiredText(next?.conversationId))
+      throw new Error("Application session is required");
     if (turnBinding && !validId(next.sessionId)) throw new Error("publisher_trusted_session_required");
     if (next.userId === binding.userId && next.conversationId === binding.conversationId &&
         (!turnBinding || next.sessionId === binding.sessionId)) return;

package/dist/server.js

@@ -59,8 +59,14 @@ function normalizeOptions(options) {
     options.blockedCategories.some(value => typeof value !== "string" || !value.trim())))
     throw new Error("publisher_blocked_categories_invalid");
   if (!["chat", "code", "image", "voice", "agent"].includes(options.jobType) || typeof options.locale !== "string" || !options.locale) throw new Error("publisher_job_invalid");
-  const base = String(options.apiBaseUrl || "https://api.wavebird.ai").trim().replace(/\/+$/, "").replace(/\/v1$/, "") + "/v1";
-  if (!/^https:\/\//.test(base)) throw new Error("publisher_api_https_required");
+  const apiBaseUrl = options.apiBaseUrl === undefined ? "https://api.wavebird.ai" : options.apiBaseUrl;
+  if (typeof apiBaseUrl !== "string" || !apiBaseUrl.trim() || /[\\?#]/.test(apiBaseUrl)) throw new Error("publisher_api_https_required");
+  const endpoint = apiBaseUrl.trim();
+  let parsedEndpoint;
+  try { parsedEndpoint = new URL(endpoint); } catch { throw new Error("publisher_api_https_required"); }
+  if (parsedEndpoint.protocol !== "https:" || !parsedEndpoint.hostname || parsedEndpoint.username || parsedEndpoint.password ||
+      parsedEndpoint.search || parsedEndpoint.hash) throw new Error("publisher_api_https_required");
+  const base = endpoint.replace(/\/+$/, "").replace(/\/v1$/, "") + "/v1";
   {
     if (!Array.isArray(options.publicOrigins) || options.publicOrigins.length < 1 || options.publicOrigins.length > 8) throw new Error("publisher_public_origins_invalid");
     for (const origin of options.publicOrigins) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wavebirdai/api",
-  "version": "0.1.0-beta.6",
+  "version": "0.1.0-beta.8",
   "private": false,
   "type": "module",
   "description": "Integrate Banner, Native, and Clip placements into authenticated chat apps with server-side keys, consent, and generation lifecycle handling",

package/src/browser.js

@@ -20,8 +20,14 @@ function loadRenderer(url) {
 
 export function createPublisherAds(options) {
   const target = options.target;
-  if (!target || !options.userId || !options.conversationId) throw new Error("Application container and session are required");
+  const requiredText = value => typeof value === "string" && value.trim().length > 0;
+  if (!target || !requiredText(options.userId) || !requiredText(options.conversationId))
+    throw new Error("Application container and session are required");
   if (!["chat", "code", "image", "voice", "agent"].includes(options.jobType)) throw new Error("publisher_job_invalid");
+  if (typeof options.clientId !== "string" || !options.clientId.startsWith("wbproj_"))
+    throw new Error("publisher_project_invalid");
+  if (typeof options.surfaceId !== "string" || !/^[A-Za-z0-9_-]{1,128}$/.test(options.surfaceId))
+    throw new Error("publisher_placement_invalid");
   const turnBinding = options.turnBinding === true;
   const validId = value => typeof value === "string" && /^[A-Za-z0-9_-]{1,128}$/.test(value);
   if (turnBinding && !validId(options.sessionId)) throw new Error("publisher_trusted_session_required");
@@ -64,7 +70,8 @@ export function createPublisherAds(options) {
   const prepare = () => { if (!disposed && sponsor) void sponsor.prepare().catch(() => {}); };
   function setConversation(next) {
     if (disposed) return;
-    if (!next.userId || !next.conversationId) throw new Error("Application session is required");
+    if (!requiredText(next?.userId) || !requiredText(next?.conversationId))
+      throw new Error("Application session is required");
     if (turnBinding && !validId(next.sessionId)) throw new Error("publisher_trusted_session_required");
     if (next.userId === binding.userId && next.conversationId === binding.conversationId &&
         (!turnBinding || next.sessionId === binding.sessionId)) return;

package/src/server.js

@@ -59,8 +59,14 @@ function normalizeOptions(options) {
     options.blockedCategories.some(value => typeof value !== "string" || !value.trim())))
     throw new Error("publisher_blocked_categories_invalid");
   if (!["chat", "code", "image", "voice", "agent"].includes(options.jobType) || typeof options.locale !== "string" || !options.locale) throw new Error("publisher_job_invalid");
-  const base = String(options.apiBaseUrl || "https://api.wavebird.ai").trim().replace(/\/+$/, "").replace(/\/v1$/, "") + "/v1";
-  if (!/^https:\/\//.test(base)) throw new Error("publisher_api_https_required");
+  const apiBaseUrl = options.apiBaseUrl === undefined ? "https://api.wavebird.ai" : options.apiBaseUrl;
+  if (typeof apiBaseUrl !== "string" || !apiBaseUrl.trim() || /[\\?#]/.test(apiBaseUrl)) throw new Error("publisher_api_https_required");
+  const endpoint = apiBaseUrl.trim();
+  let parsedEndpoint;
+  try { parsedEndpoint = new URL(endpoint); } catch { throw new Error("publisher_api_https_required"); }
+  if (parsedEndpoint.protocol !== "https:" || !parsedEndpoint.hostname || parsedEndpoint.username || parsedEndpoint.password ||
+      parsedEndpoint.search || parsedEndpoint.hash) throw new Error("publisher_api_https_required");
+  const base = endpoint.replace(/\/+$/, "").replace(/\/v1$/, "") + "/v1";
   {
     if (!Array.isArray(options.publicOrigins) || options.publicOrigins.length < 1 || options.publicOrigins.length > 8) throw new Error("publisher_public_origins_invalid");
     for (const origin of options.publicOrigins) {